Linux Hardening

Versionshistorie: CHANGELOG.poly.

Extra package sources

Vendor-Listen (/etc/apt/sources.list, Distro-Defaults) bleiben. Zusaetzliche Listen werden vor update_cache und Package-Install geschrieben.

src ist relativ zu block.artifacts.path (artifacts/blocks/<block.name>/…).

config:
  apt:
    sources:
      - dest: /etc/apt/sources.list.d/internal.sources
        content: |
          Types: deb
          URIs: https://apt.internal.example/debian
          Suites: trixie
          Components: main
      # oder Datei vom Controller:
      # - dest: /etc/apt/sources.list.d/internal.list
      #   src: apt/internal.list
  dnf:
    repos:
      - dest: /etc/yum.repos.d/internal.repo
        content: |
          [internal]
          baseurl=https://dnf.internal.example/$releasever/$basearch
          enabled=1
          gpgcheck=0
    # EPEL (RedHat-Familie, Alma/Rocky/RHEL). Debian/Ubuntu ignoriert das.
    epel:
      enabled: true
      source: distro          # distro | url | file
      url: ""                 # source=url: absolute RPM-URL
      file: ""                # source=file: relativ zu block.artifacts.path

dnf.epel.source: distro ist das bisherige Verhalten (Alma/Rocky: Paket epel-release; RHEL: Fedora-URL). Ohne Internet: internes dnf.repos plus epel.source: url oder file, oder epel.enabled: false wenn das interne Repo EPEL ersetzt.

Collector artifacts

Default collectors.binary.source: github laedt die bisherigen Upstream-URLs (GitHub, GitLab, timber.io). Umschaltung analog zur k3s-Binary: github | url | file. Pro Collector optional source, url, file, checksum (sonst gilt collectors.binary.*).

file relativ zu block.artifacts.path. url absolut (HTTP/FTP). checksum optional.

collectors:
  enabled: true
  binary:
    source: github            # github | url | file
  node_exporter:
    enabled: true
    version: 1.11.1
    # source: file
    # file: node_exporter-1.11.1.linux-amd64.tar.gz
    # checksum: ""

Extra CA trust (ca_trust)

ca_trust.enabled: true importiert CAs in den OS-Trust-Store. Default: workspace.secrets['ca.crt'] (Snapshot von artifacts/secrets/ca.crt). Optional ca_trust.files oder ca_trust.source_dir. Fehlende Datei ist ein No-op.

Examples

Simple

ssh_port: &ssh_port 1234
ssh_user: &ssh_user robot
ssh_fallback_port: &ssh_fallback_port 22
ssh_fallback_user: &ssh_fallback_user root

blocks:
  - name: hardening
    from: cargo.ayedo.cloud/ayedo/linux/hardening
    inventory:
      from: vpc
    config:
      firewall:
        enabled: false
        allow_ssh: true
        allow_tcp_port:
          - 80
          - 443
      ssh:
        port: *ssh_port
        user: *ssh_user
        fallback_port: *ssh_fallback_port
        fallback_user: *ssh_fallback_user

Complex

zone: &zone my-org.com

netbox_endpoint: &netbox_endpoint https://netbox.example.com/
netbox_token: &netbox_token abcd1234

checkmk_agent_url: &checkmk_agent_url http://localhost:9000/cmk/check_mk/agents/check-mk-agent_2.0.0p39-1_all.deb
checkmk_endpoint: &checkmk_endpoint http://localhost:1234
checkmk_site: &checkmk_site cmk
checkmk_username: &checkmk_username username
checkmk_password: &checkmk_password password

logs_endpoint: &logs_endpoint http://localhost:8412
logs_path: &logs_path /insert/elasticsearch
logs_username: &logs_username username
logs_password: &logs_password password
metrics_endpoint: &metrics_endpoint http://localhost:8418
metrics_username: &metrics_username username
metrics_password: &metrics_password password

cloudflare_api_key: &cloudflare_api_key abcd1234

ssh_port: &ssh_port 1234
ssh_user: &ssh_user robot
ssh_fallback_port: &ssh_fallback_port 22
ssh_fallback_user: &ssh_fallback_user root

name: my-workspace
organization: my-org
blocks:
  - name: hardening
    from: cargo.ayedo.cloud/ayedo/linux/hardening
    config:
      # Cloudflare only, sorry
      dns: 
        # Settings for creating recrods on Cloudflare
        enabled: true
        zone: *zone
        dns_api_token: *cloudflare_api_key
        # Settings for configuring /etc/resolv.conf on the host
        servers:
          - 1.1.1.1
          - 8.8.8.8
      checkmk:
        enabled: true
        url: *checkmk_endpoint
        site: *checkmk_site
        auth:
          username: *checkmk_username
          password: *checkmk_password
        labels:
          tcp-4422: "true"
      checkmk_agent:
        url: *checkmk_agent_url
      netbox:
        enabled: true
        endpoint: *netbox_endpoint
        token: *netbox_token
      collectors:
        enabled: true
        node_exporter:
          enabled: true
        vector:
          enabled: true
          logs:
            enabled: true
            path: *logs_path
            endpoint: *logs_endpoint # victorialogs
            username: *logs_username
            password: *logs_password
          metrics:
            enabled: true
            endpoint: *metrics_endpoint # victoriametrics
            username: *metrics_username
            password: *metrics_password
      firewall:
        enabled: true
        allow_ssh: true
        allow_tcp_port:
          - 80
          - 443
      fail2ban:
        enabled: true
        ignore_networks:
          - 10.10.0.0/16
      ssh:
        port: *ssh_port
        user: *ssh_user
        fallback_port: *ssh_fallback_port
        fallback_user: *ssh_fallback_user
        permit_root_login: without-password
      auditd:
        enabled: true
      toolbox:
        enabled: true
        ohmyzsh:
          install: true
          theme: "lukerandall" #robbyrussell, simple, .... https://github.com/ohmyzsh/ohmyzsh/wiki/Themes
          plugins:
          - git
        eza:
          install: true
          aliases:
            - "alias ls='eza --icons --group-directories-first'"
        bat:
          install: true
          aliases:
            - "alias cat='batcat'"

actions

install

polycrate run hardening install